# Security

The utilities used for managing cryptographic keys, certificates, etc. are stored in the \<dms-folder>/app/bin folder (.sh for Linux, .bat for Windows).

app/

├── bin

│   ├── certedit.sh

│   ├── dbputil.sh

│   ├── tokedit.sh

The /security folder contains information about security configurations:

* /cfg/dstk.ini contains the DSTK (Data Secure Toolkit) configuration.\
  The DSTK provides the infrastructure (PKI) and services (via cryptographic libraries) necessary for implementing a modern standards-based public key cryptographic system.\
  The default configuration suits all the use cases. Thus, no modification is needed.
* /securitystore contains the Token DB, the Password DB, and the Certificates DB configured in dstk.ini.&#x20;

## Create Token DB

During the installation, a new Token Db must be created with the utilities dbputil.sh and tokedit.sh.

The path and format of the Token Db are preset in the dstk.ini file via the following properties in the MyToken section:

* Cryptosystem: PKCS12.\
  Name: \<DMS\_HOME>/app/security/securitystore/keystore/token.p12

**DB Password Creation**

Before proceeding to create the TokenDB, a password must be created and recorded in the Password Database.

Syntax: `dbputil.sh add -p`

&#x20;When requested by dbputil, enter the password interactively.

**Token DB Creation**

Run the following command:

Syntax: `tokedit.sh create -p`&#x20;

When requested by tokedit, enter the password interactively.&#x20;

## Migration of keys and certificates

### Export from Spazio

In Spazio, keys and certificates can be configured in the following files:

<table><thead><tr><th valign="top">.ini file</th><th valign="top">File Sections</th></tr></thead><tbody><tr><td valign="top">dstk.ini</td><td valign="top"><ul><li>CDB - Certificates DataBase</li><li>MyToken - User's personal token information: the database containing the keys can be configured in the property Name of this section. If not specified, the default value is $HOME/.dstk/token.sdb</li><li>SSL Security Configuration: the database containing the keys used by SSL can be configured in the TokenName property of this section. If not specified, the one configured in MyToken.Name</li><li>SSH Security Configuration: The TokenName property in this section allows the database containing the keys used by SSH to be configured. If not specified, the one configured in MyToken.Name will be used.</li></ul></td></tr><tr><td valign="top">pps.ini</td><td valign="top"><ul><li>global: in the CryptoSysPar property, the database containing the keys can be configured.</li></ul></td></tr><tr><td valign="top">ssl.ini</td><td valign="top">All ProtocolName sections may contain TokenName.</td></tr><tr><td valign="top">ssh.ini</td><td valign="top">All ProtocolName sections may contain TokenName.</td></tr></tbody></table>

#### E**xport Keys**

The keys are stored in the token database, which can have different formats (sdb, jks, pkcs12). In the configuration files mentioned above, the path to the token database can be specified.

Below are the sections and the properties to be checked:

<table><thead><tr><th valign="top">.ini file</th><th valign="top">Section</th><th valign="top">Property</th><th valign="top"></th></tr></thead><tbody><tr><td valign="top">dstk.ini</td><td valign="top">MyToken</td><td valign="top">Name</td><td valign="top"> </td></tr><tr><td valign="top">SSL</td><td valign="top">TokenName</td><td valign="top"> </td><td valign="top"></td></tr><tr><td valign="top">SSH</td><td valign="top">TokenName</td><td valign="top"> </td><td valign="top"></td></tr><tr><td valign="top">pps.ini</td><td valign="top">global</td><td valign="top">CryptoSysPar</td><td valign="top"> </td></tr><tr><td valign="top">ssl.ini</td><td valign="top">&#x3C;Custom Section></td><td valign="top">TokenName</td><td valign="top">may contain several TokenNames in different sections; for example, it could contain several client connections with different Token DB</td></tr><tr><td valign="top">ssh.ini</td><td valign="top">&#x3C;Custom Section></td><td valign="top">TokenName</td><td valign="top">may contain several TokenNames in different sections; for example, it could contain several client connections with different Token DB</td></tr></tbody></table>

#### E**xport Utilities**

Keys/certificates present in the tokens specified in the configuration files can be exported using the tokedit utility.

With tokedit you can export the keys present in the token database set in the ***Name*** property of the ***MyToken*** section of the dstk.ini file with the p12exp command.&#x20;

Syntax: **tokedit P12EXP \<TYPE> \<FILEOUT> \<PASSWORD>**

<table><thead><tr><th valign="top">Parameter</th><th valign="top">Description / Value</th></tr></thead><tbody><tr><td valign="top">TYPE</td><td valign="top"><p>Type of export for PKCS#12.</p><p>2: all components present in the token (certificate/public key pairs, CA certificates, private keys and data)</p></td></tr><tr><td valign="top">PASSWORD</td><td valign="top">Password to secure the exported data. If this parameter is omitted, the user will be prompted to enter it. The allowed length range is 8-64 chars. Legal characters are: uppercase A-Z, lowercase a-z, numbers 0-9, period (.), forward slash (/), underscore (_). NOTE: this password is used to encrypt the object being exported. You will then need to import the object again.</td></tr><tr><td valign="top">FILEOUT</td><td valign="top"><p>Path name of PKCS#12 file.</p><p>NOTE: if the file already exists, it will be rewritten without any additional warning.</p><p>To enable correct import in Data Mover Smart, the file name must consist of:</p><p>&#x3C;configuration_file_name>-&#x3C;section>.p12</p><p>E.g. DSTK-SSL.ini (section SSL of DSTK.INI)</p></td></tr></tbody></table>

With Tokedit, you can also check the list of tokens in the Token DB.

Syntax: **tokedit LIST \[objType]**

<table><thead><tr><th valign="top">Parameter</th><th valign="top">Description / Value</th></tr></thead><tbody><tr><td valign="top">ObjType<br>(Not mandatory)</td><td valign="top"><p>To limit the list to one particular type of object, specify one of the following values (either numerical or text values can be used, uppercase or lowercase):</p><p></p></td></tr><tr><td valign="top">0 or data</td><td valign="top">List data objects</td></tr><tr><td valign="top">1 or certificate</td><td valign="top">List X.509 certificates</td></tr><tr><td valign="top">2 or public_key</td><td valign="top">List RSA public keys</td></tr><tr><td valign="top">3 or private_key</td><td valign="top">List RSA private keys</td></tr><tr><td valign="top">4 or secret_key</td><td valign="top">List all object types</td></tr><tr><td valign="top">5</td><td valign="top">List all object types (default)</td></tr></tbody></table>

<table data-header-hidden><thead><tr><th valign="top"></th><th valign="top"></th></tr></thead><tbody><tr><td valign="top">0 or data</td><td valign="top">List data objects</td></tr><tr><td valign="top">1 or certificate</td><td valign="top">List X.509 certificates</td></tr><tr><td valign="top">2 or public_key</td><td valign="top">List RSA public keys</td></tr><tr><td valign="top">3 or private_key</td><td valign="top">List RSA private keys</td></tr><tr><td valign="top">4 or secret_key</td><td valign="top">List all object types</td></tr><tr><td valign="top">5</td><td valign="top">List all object types (default)</td></tr></tbody></table>

Find below the steps to be taken to export the keys:

1. Identify all the cryptographic tokens used by the Spazio installation (they may be more than 1 and of different format)
2. For each cryptographic token identified on the Spazio installation execute the tokedit P12EXP command

**Example 1**

Identified cryptographic tokens:

<table><thead><tr><th valign="top">.ini file</th><th valign="top">Token DB</th></tr></thead><tbody><tr><td valign="top">dstk.ini</td><td valign="top">[ MyToken]  → Name</td></tr></tbody></table>

&#x20;Action to be performed:

1. Export the keys and certificates in the MyToken section with the tokedit command

   E.g. TOKEDIT P12EXP 2 dstk-mytoken.p12 Pwd12345

**Example 2**

Identified cryptographic tokens:

<table><thead><tr><th valign="top">.ini file</th><th valign="top">Token DB</th></tr></thead><tbody><tr><td valign="top">dstk.ini</td><td valign="top"><p>[ MyToken]  → Name</p><p> </p><p>[ SSH] → TokenName</p></td></tr></tbody></table>

&#x20;Actions to be performed:

1. Export the keys and certificates in the MyToken section with the tokedit command

   E.g. TOKEDIT P12EXP 2 dstk-mytoken.p12 Pwd12345.
2. Export keys and certificates in the TokenDB of the SSH section:
   1. Make a copy of the dstk.ini file.
   2. Edit the MyToken section of the dstk.ini file by setting the following values:

      Name: value of the TokenName of the SSH section

      CryptoSystem: value of the Cryptosystem of the SSH section
   3. Export with the tokedit command

      E.g.  TOKEDIT P12EXP dstk-ssh.p12 Pwd12345
   4. Restore the original dstk.ini file.

**Example 3**

Identified cryptographic tokens:

<table><thead><tr><th valign="top">.ini file</th><th valign="top">Token DB</th></tr></thead><tbody><tr><td valign="top">dstk.ini</td><td valign="top">[ MyToken]  → Name</td></tr><tr><td valign="top">ssh.ini</td><td valign="top"><p>[Section1] → TokenName</p><p>[Section2] → TokenName</p></td></tr></tbody></table>

Actions to be performed:

1. Export the keys and certificates in the MyToken section with the tokedit command

   E.g. TOKEDIT P12EXP 2 dstk-mytoken.p12 Pwd12345
2. Exporting TokenDB keys and certificates in the ssh.ini file
   1. Make a copy of the dstk.ini file
   2. Export the keys and certificates in the TokenDB in Section1
   3. Modify the MyToken section of the dstk.ini file by setting the following values:
      * Name: value of the TokenName of the Section1 section of the ssh.ini file
      * CryptoSystem: value of the Cryptosystem of the Section1 section of the ssh.ini file
   4. Export with the tokedit command

      E.g.  TOKEDIT P12EXP ssh-section1.p12 Pwd12345
   5. Export the keys and certificates in the TokenDB of Section2: re-execute 2.3 and 2.4 replacing Section1 with Section2
   6. Restore the original dstk.ini file.

#### Export Certificates

X.509 public key certificates, SSH keys (Host keys and User keys) must be exported from Spazio and imported into Data Mover Smart.

The `BULK_EXPORT` command of the DSTK utility called certedit is used to perform this task.&#x20;

Syntax:

`certedit BULK_EXPORT <DIRNAME> [DB=CA|USR|PKHOST|PKUSR]`

Export ALL Certificates, the SSH Host Keys and the SSH User Key from CDB into an external directory. When this command is specified on PKHOST or PKUSR storage, a full OpenSSH public key file is exported.

<table><thead><tr><th valign="top">Parameter</th><th valign="top">Mandatory</th><th valign="top">Description / Value</th></tr></thead><tbody><tr><td valign="top">DIRNAME</td><td valign="top">Y</td><td valign="top">Full path of directory where the certificates will be exported.</td></tr><tr><td valign="top">DB</td><td valign="top">N</td><td valign="top">DB=CA|USR|PKHOST|PKUSR<br>Action is performed against CA-Store, USR-DB, User’s or CA Public Key 'CDBName' configured in the [CDB] Section of dstk.ini.</td></tr></tbody></table>

To export ALL Certificates, the SSH Host Keys and the SSH User Key run the following commands:

`certedit BULK_EXPORT <DIRNAME>` (export ALL Certificates)

`certedit BULK_EXPORT <DIRNAME> DB=PKUSR` (export SSH User Key)

`certedit BULK_EXPORT <DIRNAME> DB=PKHOST` (export SSH Host Keys)

**Example**

Below is an example for exporting all certificates in the /home/user/certificates directory

`certedit BULK_EXPORT /home/user/certificates`

`certedit BULK_EXPORT /home/user/certificates DB=PKUSR`

`certedit BULK_EXPORT /home/user/certificates DB=PKHOST`

### Import into Data Mover Smart

In Data Mover Smart there is a single Token DB for the storage of keys.

#### Import Key

In p12 files, keys can be imported with the import-p12 command of tokedit.sh (tokenedit.bat for Windows).

Syntax: `tokedit.sh import-p12 [command options]`

<table><thead><tr><th valign="top">Command option</th><th valign="top">Description / Value</th></tr></thead><tbody><tr><td valign="top">--pwd, -p</td><td valign="top">The password to access the p12 file.</td></tr><tr><td valign="top">-in, -i</td><td valign="top">The path of the P12 input file</td></tr></tbody></table>

**Example**

To import dstk-mytoken.p12 exported with password Pwd12345, use this command:&#x20;

`./tokedit.sh import-p12 –i dstk-mytoken.p12 -p Pwd12345`&#x20;

{% hint style="danger" %}
**Warning!** If there are 2 labels with the same name in several p12 files, importing the second file generates an error. In this case, the labels must be renamed with the rename command of the tokedit utility.
{% endhint %}

Syntax:&#x20;

`tokedit.sh rename [command options]`

<table><thead><tr><th valign="top">Command option</th><th valign="top">Description / Value</th></tr></thead><tbody><tr><td valign="top">--label, -l</td><td valign="top">The old entry label</td></tr><tr><td valign="top">--new-label</td><td valign="top">The new entry label</td></tr></tbody></table>

Since the token database labels set in the **Name** property of the **MyToken** section of the dstk.ini file can be renamed with tokedit, the following operations must be performed:

1. Make a copy of the dstk.ini file.
2. Set Name of section MyToken

   \[MyToken]

   ...

   Name=\<path>/dstk-ssh.p12&#x20;
3. Rename label&#x20;

   tokedit.sh rename –l label1 --new-label label1-new
4. Restore the original dstk.ini file.

After renaming, the p12 file can be imported.

#### Import Certificate

You can import X.509 public key certificates, SSH keys (Host keys and User keys) into a directory with the bulk\_import command of the certedit.sh file (certedit.bat for Windows).

Syntax:&#x20;

`certedit.sh bulk_import  [command options]`

<table><thead><tr><th valign="top">Command option</th><th valign="top">Mandatory</th><th valign="top">Description / Value</th></tr></thead><tbody><tr><td valign="top">--in, -i</td><td valign="top">Y</td><td valign="top">Path of directory containing files to import.</td></tr><tr><td valign="top">--db, -d</td><td valign="top">N</td><td valign="top">Database to query. Accepted values are: "ca", "usr", "pkhost",            "pkusr", "rev", and "pgp". Default [ca]</td></tr><tr><td valign="top">--format, -f</td><td valign="top">N</td><td valign="top"><p>File format. Accepted values are:</p><p>0 for DER, 1 for PEM, 7 for PKCS#7 PEM, 9 for automatic encoding detection, 10 for OpenSSH  public key file, 11 for Secure SHell (SSH) Public Key File, 13 for PGP/GPG Binary or ASCII Armor format. </p><p>When operating on PGP, it is optional to specify the format since only format 13 is allowed.</p></td></tr></tbody></table>

&#x20;To import ALL Certificates, the SSH Host Keys and the SSH User Key run the following commands:

`./certedit.sh bulk_import –i <PATH_DIR>` (import ALL Certificates)

`./certedit.sh bulk_import –i <PATH_DIR> -d pkhost –f 9` (import SSH Host Keys)

`./certedit.sh bulk_import –i <PATH_DIR> -d pkusr –f 9` (import SSH User Keys)

**Example**

Find below an example for importing all certificates from /home/user/certificates directory:

`./certedit.sh bulk_import –i /home/user/certificates`

`./certedit.sh bulk_import –i /home/user/certificates -d pkhost –f 9`

`./certedit.sh bulk_import –i /home/user/certificates -d pkusr –f 9`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.primeur.com/data-mover-smart/security-utilities/security.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.